5 ms·

Sounds like kernel mode DRM or some similarly unwanted bullshit.

bayindirh 9mo ago
It's probably built on systemd's Secure Boot + immutability support. As said above, it's about who controls the keys. It's either building your own castle or having to live with the Ultimate TiVo. We'll see.
- direwolf20 9mo ago
  We all know who controls the keys. It's the first party who puts their hands on the device.
  - bayindirh 9mo ago
    Doesn't have to be. While I'm not a fan of systemd (my comment history is there), I want to start from a neutral PoV, and see what it does. I have my reservations, ideas, and what it's supposed to do, but this is not a place to make speculations and to break spirits. I'll put my criticism out politely when it's time.
  - curt15 9mo ago
    And once you remove the friction for requiring cryptographic verification of each component, all it takes is one well-resourced lobby to pass a law either banning user-controlled signing keys outright or relegating them to second-class status. All governments share broadly similar tendencies; the EU and UK govts have always coveted central control over user devices.
- zb3 9mo ago
  Just to make it clear - on Android you don't have the keys. Even with avb_custom_key you can't modify many partitions.
  - bayindirh 9mo ago
    None of the consumer mobile devices give you all the keys. There are many reasons for that, but 99.9% of them are monetary reasons.
    - zb3 9mo ago
      But I want to buy that kind of device for money and I can't.. something is wrong with the market, looks like collusion..
- egorfine 9mo ago
  > who controls the keys Not you. This technology is not being built for you.
youarentrightjr 9mo ago
> Sounds like kernel mode DRM or some similarly unwanted bullshit. Look, I hate systemd just as much as the next guy - but how are you getting "DRM" out of this?
- omnicognate 9mo ago
  As the immediate responder to this comment, I claim to be the next guy. I love systemd.
  - PunchyHamster 9mo ago
    I don't like few pieces and Mr. Lennarts attitude to some bugs/obvious flaws, but by far much better than old sysv or really any alternative we have. Doing complex flows like "run app to load keys from remote server to unlock encrypted partition" is far easier under systemd and it have dependency system robust enough to trigger that mount automatically if app needing it starts
- mikkupikku 9mo ago
  I don't mind SystemD.
- josephcsible 9mo ago
  "cryptographically verifiable integrity" is a euphemism for tivoization/Treacherous Computing. See, e.g., https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html
- bri3d 9mo ago
  Hacker News has recently been dominated by conspiracy theorists who believe that all applications of cryptography are evil attempts by shadowy corporate overlords to dominate their use of computing.
  - josephcsible 9mo ago
    No, it's not "all applications of cryptography". It's only remote attestation.

It's probably built on systemd's Secure Boot + immutability support. As said above, it's about who controls the keys. It's either building your own castle or having to live with the Ultimate TiVo. We'll see.

direwolf20 9mo ago
We all know who controls the keys. It's the first party who puts their hands on the device.
- bayindirh 9mo ago
  Doesn't have to be. While I'm not a fan of systemd (my comment history is there), I want to start from a neutral PoV, and see what it does. I have my reservations, ideas, and what it's supposed to do, but this is not a place to make speculations and to break spirits. I'll put my criticism out politely when it's time.
- curt15 9mo ago
  And once you remove the friction for requiring cryptographic verification of each component, all it takes is one well-resourced lobby to pass a law either banning user-controlled signing keys outright or relegating them to second-class status. All governments share broadly similar tendencies; the EU and UK govts have always coveted central control over user devices.
zb3 9mo ago
Just to make it clear - on Android you don't have the keys. Even with avb_custom_key you can't modify many partitions.
- bayindirh 9mo ago
  None of the consumer mobile devices give you all the keys. There are many reasons for that, but 99.9% of them are monetary reasons.
  - zb3 9mo ago
    But I want to buy that kind of device for money and I can't.. something is wrong with the market, looks like collusion..
egorfine 9mo ago
> who controls the keys Not you. This technology is not being built for you.

youarentrightjr 9mo ago

> Sounds like kernel mode DRM or some similarly unwanted bullshit. Look, I hate systemd just as much as the next guy - but how are you getting "DRM" out of this?

omnicognate 9mo ago
As the immediate responder to this comment, I claim to be the next guy. I love systemd.
- PunchyHamster 9mo ago
  I don't like few pieces and Mr. Lennarts attitude to some bugs/obvious flaws, but by far much better than old sysv or really any alternative we have. Doing complex flows like "run app to load keys from remote server to unlock encrypted partition" is far easier under systemd and it have dependency system robust enough to trigger that mount automatically if app needing it starts
mikkupikku 9mo ago
I don't mind SystemD.
josephcsible 9mo ago
"cryptographically verifiable integrity" is a euphemism for tivoization/Treacherous Computing. See, e.g., https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html
bri3d 9mo ago
Hacker News has recently been dominated by conspiracy theorists who believe that all applications of cryptography are evil attempts by shadowy corporate overlords to dominate their use of computing.
- josephcsible 9mo ago
  No, it's not "all applications of cryptography". It's only remote attestation.